ZeroDay Findings
Sign inSign up

Findings

CVE-2024-20353

Cisco ASA and FTD Denial of Service Vulnerability

Published Apr 24, 2024 · updated Aug 11, 2026 · cisco adaptive security appliance software

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2024 · Catalog

    Detected

    A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could

  2. Apr 24, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. May 1, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 11, 2026 · Catalog

    Updated

    A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date May 1, 2024

Affected

  • cpe cisco/adaptive security appliance software9.8.1
  • cpe cisco/adaptive security appliance software9.8.1.5
  • cpe cisco/adaptive security appliance software9.8.1.7
  • cpe cisco/adaptive security appliance software9.8.2
  • cpe cisco/adaptive security appliance software9.8.2.14
  • cpe cisco/adaptive security appliance software9.8.2.15
  • cpe cisco/adaptive security appliance software9.8.2.17
  • cpe cisco/adaptive security appliance software9.8.2.8
  • cpe cisco/secure firewall threat defense6.2.3
  • vendor Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)version unspecified

Sources

  • CISA KEVCVE-2024-20353

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.

    cisa.gov
  • CVE.orgCVE-2024-20353

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-20353

    30-day exploitation probability 70.7%

    first.org
  • NIST NVDCVE-2024-20353

    A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of servic

    nvd.nist.gov

References